What is a crypto honeypot and why is it used?
A digital contract called a “smart contract” works on a computer blockchain network called Ethereum. These contracts are like digital agreements that automatically execute when certain conditions are met. They’re getting more popular but they’re also attracting the attention of people who want to steal from them.
Now, instead of just trying to find weak contracts to steal from, some attackers are doing something sneaky. They’re creating contracts that look weak on purpose like they have a hole in them that would let someone take money from them easily. But when someone tries to take advantage of this hole, another secret trap stops them from actually getting the money.
So, what’s the point of these sneaky contracts? They’re called “honeypots,” and they work because they trick people into focusing on the obvious weakness and not noticing the hidden trap. It’s like if someone left a jar of honey out to attract bees but instead of honey, it’s a trap.
Therefore we can say that Honeypots are smart contracts with an apparent design flaw that allows a user to drain Ether (Ethereum’s native currency) from the contract by sending a certain amount of Ether beforehand. Attempting to exploit this apparent flaw, however, opens a second yet unknown trapdoor that prevents the Ether drain from succeeding. Don’t you think it should be legal maybe?
There is a question raised in the above paras about the legality of honeypots. Most of the time, it isn’t about the legality of honeypots themselves, rather, it is about their use and intent. Cybersecurity frameworks typically use honeypots for defensive purposes. In certain situations, however, it may be illegal to use them for malicious purposes or for deception.
How does the scam work?
In this type of scam, the money involved in the transaction is locked, only the honeypot attacker or hacker can access that cash and is able to recover it. It usually works in 3 stages: the money bait, a victim falling prey, and the attackers’ encashment of victims’ money.
An attacker doesn’t need any special skills to set up honeypots in Ethereum smart contracts. In reality, an attacker has the same skills as a regular Ethereum user. All they need is the money to set up the smart contract as bait.
A honeypot operation generally consists of a computer, programs and data that mimic the behavior of a real system that might be appealing to attackers. It might look like a part of the network but it’s not. It’s separate and watched closely. The reason for this is that regular, good users of the network don’t have any reason to go near the honeypot.
So, if anyone tries to communicate with it, it’s assumed they’re up to no good, like trying to hack or attack it. Usually, this honeypot is put in a specific area of the network called the demilitarized zone (DMZ). It’s kind of like a buffer zone between the main network and the outside world. Placing the honeypot here means it’s still connected to everything, but it’s easier to keep an eye on.
By doing this, if attackers try to mess with the honeypot it’s less likely they’ll be able to cause problems for the main network. It acts like a decoy spiker in a volleyball match so that the main spiker can go for the kill.
Types of honeypots
Honeypots are divided into two types based on their design and deployment: research and production. Honeypots for research collect information on attacks and are used to analyze hostile behavior in the wild.
They acquire information on attacker tendencies, vulnerabilities and malware strains that adversaries are currently targeting by looking at your environment and the outside world.
On the other hand, production honeypots are used to detect active network penetrations and deceive attackers. Honeypot provides additional monitoring opportunities and fills in common detection gaps around identifying network scans and lateral movement. Thus, obtaining data remains a top priority.
Production honeypots run services that would typically run in your environment alongside the rest of your production servers. Research honeypots are more complicated and store more data types.
This and research honeypots have many tiers depending on the level of sophistication your company needs. There are High-interaction honeypots, Mid, Pure and Low-interaction honeypots. High-interaction honeypots take a lot of resources and are hard to maintain, but they can be worth it.
Examples of Honeypot scams
Dechat’s honeypot mishap
In February, there was an incident involving Dechat, a Web3 communication protocol, during the launch of its new token. Mistakenly, Dechat shared a faulty link leading some users to fall victim honeypot crypto scam.
The error was brought to light on February 26 by ZachXBT, a researcher, who pointed out that Dechat had linked to a honeypot during its token launch announcement. Following this discovery, Dechat promptly rectified the mistake by removing the incorrect post and replacing it with the accurate link for PancakeSwap.
Despite the correction members of the community expressed frustration. One individual claimed to have lost money due to the incorrect link and inquired about compensation from Dechat. They stated, “You guys posted the wrong contract address and link for Pancakeswap!! I lost money because of that!! Will you compensate me for that?”
Following the resolution of the issue, Dechat’s new token, DECHAT, commenced trading on various exchanges such as KuCoin and Bybit on February 26.
Squid game honeypot scam
Another famous example is the Squid Game honeypot token scam from November 2021. They got away with $6.38 million in untraceable BNB from the SQUID token scam. The stolen money was moved using a cryptocurrency mixer called Tornado Cash.
What happened was, Luke Hartford discovered the Squid Game crypto through a tweet by user @jonhree112, which predicted a significant increase in its value back in Nov 2021. Despite warnings of potential scams Hartford invested $300 when the coin was priced at around 90 cents per token, as per reports. As its value skyrocketed reaching $5 per token overnight, Hartford became excited about his investment’s rapid growth.
However, doubts arose when he noticed tweets from others struggling to sell their holdings and the necessity to purchase marbles to facilitate transactions.
Despite rising media coverage and the coin’s value peaking at $2,861 Hartford realized it was a scam when $3.36 million was withdrawn from the project by its creators that causing its value to plummet to almost worthless levels within minutes.
This scam got its name from the famous Netflix Korean series ‘Squid Game’. The Squid Game scam exploited the liquidity pool between Squid tokens and BNB tokens on the Binance exchange.
How to spot a crypto honeypot?
One way to spot a honeypot crypto fraud is to look at the trade history. Generally, a cryptocurrency should be able to be bought and sold whenever you want. In a honeypot scam, people will buy the coin a lot, but they’ll have a hard time selling it. Indicating that it’s not legit and you should stay away from it. Additionally, classifying contracts as honeypots or non-honeypots can also be done using data science.
What are the pros and cons?
While we conclude this, it’s important to know that Honeypots have good and bad sides. They’re traps for hackers, like tit for tat and the good part is they help experts learn from attacks without harming real systems. Also, they don’t give many false alarms like other security tools do. Plus, even if hackers use encryption, honeypots can still catch them.
But there are downsides too. Honeypots only work when attacked so if there’s no attack, they don’t show anything. Also, smart hackers can spot them and avoid them. And sometimes honeypots can accidentally give hackers access to real systems. So, while they’re helpful for learning, they’re not enough on their own.
